The Quantum Reverse Shannon Theorem based on One-Shot Information Theory 



The Quantum Reverse Shannon Theorem states that any quantum channel can be simulated by 
an unhmited amount of shared entanglement and an amount of classical communication equal to 
the channel's entanglement assisted classical capacity. In this paper, we provide a new proof of 
this theorem, which has previously been proved by Bennett, Devetak, Harrow, Shor, and Winter. 
Our proof has a clear structure being based on two recent information-theoretic results: one-shot 
Quantum State Merging and the Post-Selection Technique for quantum channels. 
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I. INTRODUCTION 

The birth of classical information theory can be dated to 1948, when Shannon derived his famous Noisy Channel 
Coding Theorem [I]. It shows that the capacity C of a classical channel 8 is given by the maximum, over the input 
distributions X, of the mutual information between the input X and the output S{X). That is 

C{8)^m&yi{H{X) + H{£{X))- H{X,£{X))} , 

where H denotes the Shannon entropy. Shannon also showed that the capacity does not increase if one allows to 
use shared randomness between the sender and the receiver. In 2001 Bennett et al. [5] proved the Classical Reverse 
Shannon Theorem which states that, given free shared randomness between the sender and the receiver, every channel 
can be simulated using an amount of classical communication equal to the capacity of the channel. This is particularly 
interesting because it implies that in the presence of free shared randomness, the capacity of a channel £ to simulate 
another channel is given by the ratio of their plain capacities Cii{£,J^) = c'{J^) ^^'^ hence only a single parameter 
remains to characterize classical channels. 

In contrast to the classical case, a quantum channel has various distinct capacities [2HZ]- In [5] Bennett et al. argue 
that the entanglement assisted classical capacity C^; of a quantum channel £ is the natural quantum generalization 
of the classical capacity of a classical channel. They show that the entanglement assisted classical capacity is given 
by the quantum mutual information 

CEi£) = max{i?(p) + H{£{p)) - ®Z)$p)} , 

p 

where the maximum ranges over all input distributions p, $p is a purification of p, I is the identity channel, and 
H denotes the von Neumann entropy. Motivated by this, they conjectured the Quantum Reverse Shannon Theorem 
(QRST) in [2]. Subsequently Bennett, Devetak, Harrow, Shor and Winter proved the theorem in [8]. The theorem 
states that any quantum channel can be simulated by an unlimited amount of shared entanglement and an amount of 
classical communication equal to the channel's entanglement assisted classical capacity. So if entanglement is for free 
we can conclude, in complete analogy with the classical case, that the capacity of a quantum channel £ to simulate 
another quantum channel is given by Ce{£ , J^) = Ce{J^) ^^'^ hence only a single parameter remains to characterize 
quantum channels. 

In addition, again analogue to the classical scenario [319], the Quantum Reverse Shannon Theorem gives rise to a 
strong converse for the entanglement assisted classical capacity of quantum channels. That is, if one sends classical 
information through a quantum channel £ at a rate of Ce{£) + ^ for some > (using arbitrary entanglement as 
assistance), then the fidelity of the coding scheme decreases exponentially in <: [S]. 

Free entanglement in quantum information theory is usually given in the form of maximally entangled states. But 
for the Quantum Reverse Shannon Theorem it surprisingly turned out that maximally entangled states arc not the 
appropriate resource for general input sources. More precisely, even if one has arbitrarily many maximally entangled 
states as an entanglement resource, the Quantum Reverse Shannon Theorem cannot be proven [8]. This is because 
of an issue known as entanglement spread, which arises from the fact that entanglement cannot be conditionally 
discarded without using communication jlOj . If we change the entanglement resource from maximally entangled 
states to embezzling states |llj however, the problem of entanglement spread can be overcome and the Quantum 
Reverse Shannon Theorem can be proven. 

A S-ebit embezzling state is a bipartite state fiAB with the feature that the transformation pAB fJ-AB 4'A'B', 
where (j)A'B' denotes an ebit (maximally entangled state of Schmidt-rank 2), can be accomplished up to an error 5 
with local operations. Remarkably, 5-eh\t embezzling states exist for all (5 > |11) . 

In this paper we present a proof of the Quantum Reverse Shannon Theorem based on one-shot information theory. 
In quantum information theory one usually makes the assumption that the resources are independent and identically 
distributed (iid) and is interested in asymptotic rates. In this case many operational quantities can be expressed in 
terms of a few information measures (which are usually based on the von Neumann entropy). In contrast to this, one- 
shot information theory applies to arbitrary (structureless) resources. For example, in the context of source coding, 
it is possible to analyze scenarios where only finitely many, possible correlated messaged are encoded. For this the 
smooth entropy formalism was introduced by Renner et al. |12H14j . Smooth entropy measures have properties similar 
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to the ones of the von Neumann entropy and like in the iid case many operational interpretations are known p!^[T3^B5] . 

For our proof of the Quantum Reverse Shannon Theorem we work in this smooth entropy formalism and use a 
one-shot version for Quantum State Merging and its dual Quantum State Splitting as well as the Post-Selection 
Technique for quantum channels. As in the original proof of the Quantum Reverse Shannon Theorem j8j we need 
embezzling states. 

Quantum State Merging was introduced by Horodecki et al. in [301 I31| . It has since become an important tool 
in quantum information processing and was subsequently reformulated in [32], where it is called mother protocol. 
Quantum State Merging corresponds to the quantum generalization of classical Slepian and Wolf coding [33] . For its 
description, one considers a sender system, traditionally called Alice, a receiver system. Bob, as well as a reference 
system R. In Quantum State Merging, Alice, Bob, and the reference are initially in a joint pure state Pabr and 
one asks how much of a given resource, such as classical or quantum communication or entanglement, is needed 
in order to move the A-part of pabr from Alice to Bob. The dual of this, called Quantum State Splitting^ ad- 
dresses the problem of how much of a given resource, such as classical or quantum communication or entanglement, is 
needed in order to transfer the >l'-part of a pure state paa'R, where part AA' is initially with Alice, from Alice to Bob. 

The Post- Selection Technique was introduced in j34| and is a tool in order to estimate the closeness of two completely 
positive and trace preserving (CPTP) maps that act symmetrically on an n-partite system, in the metric induced by 
the diamond norm, the dual of the completely bounded norm [3S] . The definition of this norm involves a maximization 
over all possible inputs to the joint mapping consisting of the CPTP map tensored with an identity map on an outside 
system. The Post-Selection Technique allows to drop this maximization. In fact, it suffices to consider a single de 
Finetti type input state, i.e. a state which consist of n identical and independent copies of an (unknown) state on 
a single subsystem. The technique was applied in quantum cryptography to show that security of discrete-variable 
quantum key distribution against a restricted type of attacks, called collective attacks, already implies security against 
the most general attacks [34] . 

Our proof of the Quantum Reverse Shannon Theorem is based on the following idea. Let Ea^b be a quantum channel 
that takes inputs pA on Alice's side and outputs £a^b{pa) on Bob's side. To find a way to simulate this quantum 
channel, it is useful to think of Ea^b as 

£a^b{pa) = trc {Ua^bc) Pa (Ua^bc)^ 

where C is an additional register and Ua^bc is some isometry from A to BC. This is the Stinespring dilation |36j . 
Now the idea is to first simulate the isometry Ua-^bc locally at Alice's side, resulting in psc = {UA^Bc)PAiUA^Bcy , 
and in a second step use Quantum State Splitting to do an optimal state transfer of the i?-part to Bob's side, such 
that he holds pB — £a^b{pa) in the end. This simulates the channel £a~>b- To prove the Quantum Reverse Shannon 
Theorem, it is then sufficient to show that the classical communication rate of the Quantum State Splitting protocol 
is CEiS). 

We realize this idea in two steps. Firstly, we propose a new version of Quantum State Splitting (since the known 
protocols are not good enough to achieve a classical communication rate of Ce{£)), which is based on one-shot 
Quantum State Merging |15j . For the analysis we require a decoupling theorem, which is optimal in the one-shot 
case [16[ I37j . This means that the decoupling can be achieved optimally even if only a single instance of a quantum 
state is available. Secondly, we use the Post-Selection Technique to show that our protocol for Quantum State 
Splitting is sufficient to asymptotically simulate the channel Sa-^b with a classical communication rate of Ce(£). 
This then completes the proof of the Quantum Reverse Shannon Theorem. 

Our paper is structured as follows. In Section |ll] we introduce our notation and give some definitions. In particular, 
we review the relevant smooth entropy measures. Our results about Quantum State Splitting are then discussed in 
Section |III[ Finally, we give our proof of the Quantum Reverse Shannon Theorem in Section |IV[ The argument uses 
various technical statements (e.g. properties of smooth entropies), which are proved in the appendix. 



II. SMOOTH ENTROPY MEASURES - NOTATION AND DEFINITIONS 



We assume that all Hilbert spaces, in the following denoted H, are finite-dimensional. The dimension of 'Ha is 
denoted by \ A\. The set of linear operators on H is denoted by £{71) and the set of positive semi-definite operators on 
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T-L is denoted by P{H). We define the sets of subnormalized states S<:{H) = {p E V{T-L) : tr[/3] < 1} and normalized 
states = {p e : tr[p] = 1}). 

Ttie tensor product of Ha and is denoted by Hab = Ha ^Hb- Given a multipartite operator pab € "P^T-Lab), 
we write pA = ^t:b[pab] for the corresponding reduced operator. For Ma G C{'Ha), we write Ma = Ma (X" 1_b for 
the enlargement on any T-Lab, where 1^ denotes the identity in C{'Hb)- Isometrics from T-La to Hb sic denoted by 
Va^b- 

For Ha, Hb with bases {|i)A}'='i, {N)b}'=i and |^| — \B\, the canonical identity mapping from CIHa) to C{'Hb) 
with respect to these bases is denoted by Xa^b, i-e. Iyi-j-B(|*)(jU) = IOOIb- ^ linear map Sa^b '■ ^{'Ha) 'C('Hb) 
is positive if £a^b{pa) G 'PCHb) for all pa G V{%a)- K is completely positive if the map {£a^b ®'^c^c) is positive 
for all T-Lc- Completely positive and trace preserving maps are called CPTP maps or quantum channels. 

The support of p G V{'H) is denoted by supp(p), the projector onto supp(p) is denoted by p° and tr [p"] = rank(p), 
the rank of p. For p G VCH) we write ||p|loo for the operator norm of p, which is equal to the maximum eigenvalue of p. 

Recall the following standard definitions. The von Neumann entropy of p E S={H) is defined a^ 

iJ(p) = -tr[plogp] . (1) 

The quantum relative entropy of p E S<{'H) with respect to a E V{H.) is given by 

i?(p||(7) -tr[plogp]-tr[plog(T] (2) 

if supp(p) C supp((t) and oo otherwise. The conditional von Neumann entropy of A given B for pab G S={'H) is 
defined as 

H{A\B)p = -D{pab\\1a®Pb)- (3) 
The mutual information between A and B for pab G S^{'H) is given by 

I{A:B)p^D{pab\\pa®Pb)- (4) 

Note that we can also write 

H{A\B)p = - inf D{pab\\1a ® (Tb) 
I{A:B)p= inf D{pab\\pa® (Tb) ■ 

We now give the definitions of the smooth entropy measures that we need in this work. In Appendix[B]some basic prop- 
erties are summarized. For a more detailed discussion of the smooth entropy formalism we refer to jl2i jTTl [TSl [351 ISH] ■ 

Following Datta |18j we define the max-relative entropy of p E 5<('H) with respect to a E V{'H) as 

Anax(plk) = inf{A G M : 2^ • a > p} . (5) 

The conditional min-entropy of A given B for pab G S<{'Hab) is defined as 

H^i^{A\B)p = - inf Anax (pab II 1 A «) cTfi) • (6) 

(tb^S=(^b) 

In the special case where B is trivial, we get -ffmin(^)p = — log ||pa||oo- 
The max-information that B has about A for pab G S<{'Hab) is defined as 

/max(^ : B)p = inf -DmaxlPAsUpA ® Ob) ■ (7) 

(yBf^S^iUB) 



^ All logarithms are taken to base 2. 



5 



Note that unlike the mutual information, this definition is not symmetric. 

The smooth entropy measures are defined by extremizing the non-smooth measures over a set of nearby states, where 
our notion of nearby is expressed in terms of the purified distance. For p, ct G S< {%) it is defined as [391 Definition 4] 



P(p,a)-^1-F2(p,a) , (8) 

where F{- ,■) denotes the generalized fidelity (which equals the standard fidelitjj^ if at least one of the states is 
normalized) , 

Fip,(^) = (l-trp)v/ff® (l-tra)ll^ = i^(p,CT) + v/(l-trp)(l-tra) . (9) 

The purified distance is a distance measure on S<{'H) [Ml Lemma 5], in particular, it satisfies the triangle inequality 
P{p,o') ^ -P(PiW) + P{u;,a) for p, cr, w G 5<(H). P{p,a) corresponds to one half times the minimum trace distance^ 
between purifications of p and a. 

Henceforth we call p, a £ S<:{H) e-close if P{p,a) < e and denote this by p «e a. We use the purified distance to 
specify a ball of subnormalized density operators around p G 5<('H): 

B%p) = {p(.S<{n):P{p,p)<e} . (10) 

Miscellaneous properties of the purified distance that we use for our proof are stated in Appendix For a further 
discussion we refer to [55] . 

For e > 0, the smooth conditional min- entropy of A given B for pab G S<{'Hab) is defined as 

H'^^^{A\B)p^ sup i?,„i„(A|S)p . (11) 

PAB&B^ (pab) 

The smooth max-information that B has about A for pab G S<{'Hab) is defined as 

Il,M--B)p^ inf I^UA:B)p. (12) 

PAB'iO'(pAB) 

The smooth entropy measure can be seen as a generalization of its corresponding von Neumann quantity in the 
sense that the latter can be retrieved asymptotically by evaluating the smooth entropy measure on iid states (cf. Re- 
mark B.20 and Corollary In Section III we give an operational meaning to the smooth max-information 



(Theorem III. 10 and Theorem 



III.ll 



Since all Hilbert spaces in this paper are assumed to be finite dimensional, we are allowed to replace the infima by 
minima and the suprema by maxima in all the definitions of this section. We will do so in the following. 



III. QUANTUM STATE SPLITTING 



The main goal of this section is to prove that there exists a one-shot Quantum State Splitting protocol (Theo- 
rem III. 10 1 that is optimal in terms of its quantum communication cost (Theorem III.ll I. The protocol is obtained 



by inverting a one-shot Quantum State Merging protocol. 

The main technical ingredient for the construction of these protocols is the following decoupling theorem (Theo- 
rem III.l ). The proof of the decoupling theorem can be found in Appendix [Cj 

Theorem III.l. Let e > 0, par G S<{'Har) and consider a decomposition of the system A into two subsystems Ai 
and A2- Furthermore define (tair{U) ~ tr^^ \{U ® lii)pAR{U^ €5 1_r)] . If 

\og\A\+H^,^{A\R)p . 1 



log \Ai 



< 



- log 



(13) 



2 The fidelity between p,a £ S<{n) is defined by F{p,a) = \\^y^\\^, where ||r||^ = tr I^VfftJ . 

^ The trace distance between p,(J & S<{'H) is defined by ||p— cr\\-^. The trace distance is often defined with an additional factor one half; 

we choose not to do this. 
* For an operational meaning of the smooth conditional min-entropy see e.g. |12l I15| . 
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then 



U{A) 



dU <e , 



(14) 



where dU is the Haar measure over the unitaries on system A, normahzed to J dU = 1. 

An excellent introduction into the subject of decoupling can be found in [i^. Note that our decoupling theorem 
(Theorem III.l ) can be seen as a special case of a more general decoupling theorem (TBI [37]. It is possible to formulate 
the decoupling criterion in Theorem |III ■ 1 1 more generally in terms of smooth entropies, which is then optimal in the 
most general one-shot case (THl US] ■ 

Quantum State Merging, Quantum State Splitting, and other related quantum information processing primitives are 
discussed in detail in |T5| ,l30H32ll41j . Note that we are not only interested in asymptotic rates, but in (tight) one-shot 
protocols. This is reflected by the following definitions. 

Definition III. 2 (Quantum State Merging). Consider a bipartite system with parties Alice and Bob. Let e > 

and pABR — \p){p\abr G S<:{Habr), where Alice controls A, Bob B and i? is a reference system. A CPTP map 
£ is called e-error Quantum State Merging of pabr if it consists of applying local operations at Alice's side, local 
operations at Bob's side, sending q qubits from Alice to Bob and outputs a state 



{£ ®Ir){PABr) ~e PB'BR® \(t>L){(t>L\ 



(15) 

)Ibr)pabr- q is called 



where \4>l){4'l\aiBi is a maximally entangled state of Schmidt-rank L and pb'BR. = {^a^B' 
quantum communication cost and e = [log L\ entanglement gain. 

Quantum State Merging is also called Fully Quantum Slepian Wolf (FQSW) or mother protocol |32) . 

Lemma III. 3. Let e > and pabr — \p){p\abr G S<{'Habr)- Then there exists an e-error Quantum State Merging 
protocol for pabr with a quantum communication cost of 



q ■ 



1 



{Ha{A)p~H,^,^{A\R)p) + 2-\oi 



1 



and an entanglement gain of 



where Hq{A)p = logrank(py 



(i/o(^)p + i?mi„(^|i?)p)-2-log- 



(16) 



(17) 



Proof. The intuition is as follows (cf. Figure [T]). First Alice applies a unitary Ua^AiA2- After this she sends A2 
to Bob who then performs a local isometry Va2B^B' bBi- We choose Ua~¥AiA2 such that it decouples Ai from the 
reference R. After sending the ^2-part to Bob, the state on AiR is given by ® PR ^-^i^ Bob holds a purification 



of this. But 



PR is the reduced state of pb'br ^ \4>l){4'l\aiBi and since all purifications are equal up to lo- 



cal isometries, there exists an isometry VAaS-s-s'BBi on Bob's side that transforms the state into pb'br'^\4>l){4>l\aiBi ■ 
More formally, let A — A1A2 with log IA2I — [|(log \ A\ — H^in{A\R) p) + 2-log . According to the decoupling theorem 



(Theorem III.l ), there exists a unitary Ua^AiA2 such that for aAiA2BR^ = (Ua- 



' ^br)pabr{U\ 



A^AiA2 



^BR 



C^Aifl ~ YAt\®PR 

this implies uaiR ' 



< e^. By an upper bound of the purified distance in terms of the trace distance (Lemma 



1ai 
l^il 



A.l) 



' PR- 



We apply this unitary Ua-^AiA2 and then send A2 to Bob; therefore q — [^(log |A| — _ffinin(^|^)p) + 2 • log . 
Uhlmann's theorem [42l [43] tells us that there exists an isometry Va2B->b' bBi such that 

1ai 



P (^AiR, 



Pr) ^ P ((1Ai_R (8 Va2B^B'BBi) a-AiA2BR{'^AiR ^ VAaB^B'BsJ^ |0l)(0lUiBi ^ PB'Br) 



Hence the entanglement gain is given by e = [|(log \ A\ + iJi„in(j4|i?)p) — 2 • log . Now if pA has full rank this is 

already what we want. In general logtr [p^] = log \ A\ < log \ A\. But in this case we can restrict the Hilbert space 
Ha to the subspace on which pA has full rank. □ 
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Definition III. 4 (Quantum State Splitting with maximally entangled states). Consider a bipartite system with 
parties Alice and Bob. Let e > and paa'r = \p){p\aa'r & S<{Haa'r), where Alice controls AA' and i? is a 
reference system. Furthermore let \<t>K){<f'K\AiBi be a maximally entangled state of Schmidt-rank K between Alice 
and Bob. A CFTP map £ is called e-error Quantum State Splitting of paa' r. with maximally entangled states if it 
consists of applying local operations at Alice's side, local operations at Bob's side, sending q qubits from Alice to Bob 
and outputs a state 

{E ®Ib){paA'R® |(?!'k)((/'kUiSi) ~e PABR , (18) 

where pabr — {^A'^b ®^ar)paa'r- 1 is called quantum communication cost and e — [log A'J entanglement cost. 

This is also called the Fully Quantum Reverse Shannon (FQRS) protocol |32j . which is a bit misleading, since there 
is a danger of confusion with the Quantum Reverse Shannon Theorem. 

Quantum State Splitting with maximally entangled states is dual to Quantum State Merging in the sense that every 
Quantum State Merging protocol already defines a protocol for Quantum State Splitting with maximally entangled 
states and vice versa. 

Lemma III. 5. Let e > and paa'r = \p){p\aa'r G SkCHaa'r)- Then there exists an e-error Quantum State 
Splitting protocol with maximally entangled states for paa'R with a quantum communication cost of 



1 



(i7o(A')p-i/min(A'|i?)p)+2-log 



and an entanglement cost of 



where Ho{A')p = log rank(pyi' ) . 



^(iJo(A')p + H,nin(A'|i?)p) - 2 • log ^ 



(19) 



(20) 



Proof. The Quantum State Splitting protocol with maximally entangled states is defined by running the Quantum 
State Merging protocol of Theorem III.3 backwards (see Figure [l]). The claim then follows from Theorem III.3 □ 



In order to obtain a Quantum State Splitting protocol that is optimal in terms of its quantum communication cost, 
we need to replace the maximally entangled states by embezzling states 11 . 

Definition III. 6. Let 5 > 0. A state pab G S={Hab) is called a 6-ebit embezzling state if there exist isometries 
Xa^aa' and Xb^bb' such that 

{Xa^aa' ® Xb^bb')pab{Xa^aa' <»Xb^bb')^ -s Pab |0)(0U'S' , (21) 
where \(I)){(I)\a'B' G S={Ha'B') denotes an ebit (maximally entangled state of Schmidt rank 2). 
Proposition III. 7. [11] (5-ebit embezzling states exist for all S > 0. 

We would like to highlight two interesting examples. For the first example consider the state \pm){pm\A"^B™ G 
S={T-La"^B"^) defined by 



.B^^C-J2\^) 

J=0 



AB 



, (8)(m-j") 
'AB 



where \ip){(p\AB G S={'Hab), \4>){4>\ab G S^{T-Lab) denotes an ebit and C is such that \pm){pm\A"^B"^ is normalized. 
Note that applying the cyclic shift operator UaoA^^ that sends Ai — )• A^+i at Alice's side (modulo m + \) and the 
corresponding cyclic shift operator UboB^ at Bob's side maps \ip)AaBo ® \pm)A"^B'" to |(/')aoBo ® \pm,)A'"B'" up to an 

accuracy of [Hj. For the choice \(p)ab — |</')a ® \'p)b, iMm) (/^mU'"B™ is a ^/^-ebit embezzling state with the 

isometries A^^^^AqA™ = UaoA^^\v)ao and Xb^^^^BoB-" = UboB"A'P)bo- 
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State Merging State Splitting 




FIG. 1. From the protocol for Quantum State Merging, which we describe in Lemma |III.3[ we get a protocol for Quantum 
State Splitting with maximally entangled states. All we have to do is to run the Quantum State Merging protocol backwards. 



The second example is the state |/im)(AtmUs G S={'Hab) defined by 



\~Dab 



It is a y^-ebit embezzling state [lljj^ 



Remark III. 8. By using (5-ebit embezzling states multiple times, it is possible to create maximally entangled states 
of higher dimension. More precisely, for every i5-ebit embezzling state fj,AB G S={'Hab) there exist isometries Xa-^aa' 
and Xb^bb' such that 

{Xa^AA' «> XB^BB')fJ'AB{XA^AA' «> Xb^BB'V ~S-\ogL l^AB ® (0L U'S' , (22) 

where \4>l){4>l\a'B' G S^{'Ha' B') denotes a maximally entangled state of Schmidt-rank L (with L being a power of 
2). 

We are now ready to define Quantum State Splitting with embezzling states. 

Definition III. 9 (Quantum State Splitting with embezzling states). Consider a bipartite system with parties Alice 
and Bob. Let e > 0, (5 > and paa'r = \p){p\aa'R G S<{V.aa'r), where Alice controls AA' and i? is a reference 
system. A CPTP map £ is called e-error Quantum State Splitting of paa'r with a 5-ebit embezzling state if it consists 
of applying local operations at Alice's side, local operations at Bob's side, sending q qubits from Alice to Bob, using 
a (5-ebit embezzling state MAombSombi outputs a state 

{£ (g) Tr){paA'R ® IJ-A^^^B^^^) ~e PABR , (23) 

where pabr = {Ia'-^b ®^ar)paa'r- 1 is called quantum communication cost. 



^ The state \fim)(p-m\AB is even a ^ , r)-universal embezzling state 1111 . That is, for any |?)(<;|yi'S' S S={'Ha'b') of Schmidt-rank at 
most r, there exist isometries X^^^^/ and Xg^ggi such that 

{Xa^AA' ® XB^BB')\i^m.){ilm\AB(XA-^AA' ® ^B^BB'V ~ rT \fl-m) {p.m\ AB ® kX^U'S' ■ 
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The following theorem about the achievability of Quantum State Splitting with embezzling states (Theorem III. 10 1 is 
the main result of this section. In Section [IV| we use this theorem to prove the Quantum Reverse Shannon Theorem. 

Theorem III. 10. Let e > 0, e' > 0, 5 > and paa'R ~ \p){p\aa'R G S<{'Haa'r)- Then there exists an {e + e' + S ■ 
log \ A'\ + |A'|^^/^)-erroi[^ Quantum State Splitting protocol for paa'R with a <5-ebit embezzling state for a quantum 
communication cost of 

9 < llL.{A' : i?)p + 2 • log 1 + 4 + log log \A'\ . (24) 



Proof. The idea for the protocol is as follows (cf. Figure [2]). First, we disregard the eigenvalues of pA' that are 
smaller then This introduces an error a = but because of the monotonicity of the purified distance 

(Lemma A. 2), the error at the end of the protocol is still upper bounded by the same a. As a next step we let Alice 
perform a coherent measurement W with roughly 2 • log \ A\ measurement outcomes in the eigenbasis of pA'- That is, 
the state after the measurement is of the form loaa'RIa ~ \^){^\aa'RJa with 



\^)AA'RIa 



iei 



^/P^\p' 



AA'R ' 



Here the index i indicates which measurement outcome occured, pi denotes its probability and Paa'R 
the corresponding post-measurement state. 



AA'R 



III.5 



Lemma 
by Qi and e, 



Then, conditioned on the index i, we use the Quantum State Splitting protocol with maximally entangled states from 
for each state Paa'r denote the corresponding quantum communication cost and entanglement cost 
respectively. The total amount of quantum communication we need for this is given by max^ qi plus 
the amount needed to send the register Ia (which is of order log log \ A\). In addition, since the different branches of 
the protocol use different amounts of entanglement, we need to provide a superposition of different (namely sized) 
maximally entangled states. We do this by using embezzling statesj^ 

As the last step, we undo the initial coherent measurement W. This completes the Quantum State Splitting protocol 
with embezzling states for paa'r- All that remains to do, is to bring the expression for the quantum communication 
cost in the right form. In the following, we describe the proof in detail. 

Let Q = \2 ■ log \A'\ — 1] , I ~ {0, 1, . . . , Q, (Q + 1)} and let {PA'}iei be a collection of projectors on Ha' defined 
as follows. Pa'^^ projects on the eigenvalues of pA' in [2^-^'°sl^ I q], P^, projects on the eigenvalues of pA' in 
[2-'3,2-2iogl'4'|] and for i = 0, 1, . . . , (g - 1), P\, projects on the eigenvalues of p^' in [2-^ 2-(*+i)]. 

Furthermore let pi = tr [P^.pA'], Paa'R \p'){p'\aa'R with \p'^)aa'R = p7^^'^ ■ Pa'\p)aa'R and define the state 
PAA'R = \p){p\aa'r with 

Q 

\p)aa'r = T-'^'-Y.Vp^\p1aa'r , 



i=0 



where T = Yli=oPi- 
We have 

as can be seen as follows. We have 



PAA'R ~|A'|-i/2 PAA'R 



(25) 



P{paa'r,Paa'r) = - F^{paa'r,Paa'r) = v^l - \{p\p)aa'r\^ = 



\ 



1 - ^Pi = y/PQ+l 



^ The error term can be made arbitrarily small by enlarging the Hilbert space "H^'. Of course this increases the error term 

S ■ log \A'\, but this can again be compensated with decreasing 5. Enlarging the Hilbert space Ha' '^^so increases the quantum commu- 
nication cost | |24| l, but only slightly. 

''' Note that it is not possible to get such a superposition starting from any amount of maximally entangled states only using local 
operations. This problem is known as entanglement spread and is discussed in |10| . 
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FIG. 2. A schematic description of our protocol for Quantum State Splitting with embezzling states in the language of the 
quantum circuit model [451 146) . See the text for definitions and a precise description. 



But because at most \A'\ eigenvalues of pA' can lie in [2-2i°sl^'l,o], each one smaller or equal to 2 s 1^ I ^ we obtain 
PQ+i < l^'l • 2-2i°gl^'l = \A!\-^ and hence P{paa'r,Paa-r) < \A'\-^/\ 



We proceed by defining the operations that we need for the Quantum State Splitting protocol with embezzling states 
for pAA'R (cf. Figure [2]). Define the isometry 



A'^A'Ia 



WlA 



(26) 



where the vectors \i)A are mutually orthogonal and I a is at Alice 's sid e. We want to use the £-error Quantum State 
Splitting protocol with maximally entangled states from Lemma 
protocol has a quantum communication cost of 



III.5 



for each p\a'R- -f'o'^ ea.ch. i = 0, 1, . . . , Q this 



and an entanglement cost of 



\{H^[j^)p, - i7,„i„(A'|i?)pO + 2 • log i 



;^(i/o(A')p. + H^,^{A'\R)p.) - 2 • log - 
2 e 



(27) 



For Ai on Alice's side, Bi on Bob's si de an d A\, B\ 2'^' -dimensional subspaces of Ai, Bi respectively, the Quantum 
State Splitting protocol from Lemma IIL5 has the following form: apply the isometry V^^,^i^j^gi on Alice's side, 

send BI from Alice to Bob (for a quantum communication cost of qi) and then apply the isometry Ugi^i^g on Bob's 
side. 



As a next ingredient to the protocol, we define the isometrics that supply the maximally entangled states of size e^. For 
I = 0, 1, . . . , Q, let X\ . and Xl, „ be the isometries at Alice's and Bob's side respectively, that em- 

bezzle, with accuracy 5-ei, a maximally entangled state of dimension out of the embezzling state and put it in A\B\. 
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We are now ready to put the isometries together and give the protocol for Quantum State Sphtting with embezzUng 
states for paa'r (cf. Figure [2]). Ahce apphes the isometry Wa'^A'Ia followed by the isometry 



and the isometry 



VaA'A.Ia^AB^Ia = X! ^AA'Al^ABl ® V){Aia 



i=Q 



Afterwards she sends I a and ^2, that is 

^1 



q = max 



2 (i?o(A')p. - ff„,in(A'|i?)pO + 2 • log - 



log r2-iog|A'n 



qubits to Bob (where we rename I a to Ib)- Then Bob applies the isometry 



Q 

z=l 



3; ® 



followed by the isometry 



(28) 



Next we analyze how the resulting state looks like. By the definition of embezzling states (cf. Definition III. 6 and 



Remark III.8I, the monotonicity of the purified distance (Lemma A. 2 1 and the triangle inequality for the purified 



distance, we obtain a state (TabrIb — \'^){'^\abrIb with 



W)abrIb = T VPi\p')ABR ® \i)iB , 



1=0 



where |p')(p'UBfl = Pabr Pabr and Pabr = i^A'^B 'Si Iar)Paa'R fo^' « = 0, 1, . . . , Q. The state cfabrIb is 

close to the state uiabrib = \'^){^\abrib with 



\1^)ABR.Ib 



'Pi\P )abr (K) , 



as can be seen as follows. Because we can assume without lost of generality that all are real and nonnegativej^ 

we obtain 



P{<7ABRIbj^ABRIb) = \/l — F'^{(T ABRIb 1 ^ABRIb ) = v 1 ^ \ abr.Ib?' = 



\ 



1 - 



1 ^ 



\ 



^^{^' YP^^P'\P')ABi}j = ^ 1 " ' ^^'^ {PaBwPaBr)^ 



[pabr^Pabr]^ 



< 



e + S ■ max < e + S ■ log \A'\ , 



This can be done be multiplying the isometrics (7* , in d28k with appropriately chosen phase factors. 
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where the last inequality follows from (27). To decode the state ctabrIb to a state that is {e + 5 ■ log |^'|)-close to 



PABR, we define the isometry Wb^bIb analogously to Wa'^A'Ia (26). Because all isometries are injective, we can 



define an inverse of W on the image of W (which we denote by \m(W)). The inverse is again an isometry and we 
denote it by W'^^^^^^g. 

The last step of the protocol is then to apply the CPTP map to the state aABRis i that first does a measurement 
on BIb to decide whether ubIb ^ Im(VK) or not and then, if (TbIb ^ Im(W^), applies the isometry W^^^^^^^^ and 
otherwise maps the state to 



By the monotonicity of the purified distance (Lemma A. 2 ) wc finally get a state that is {e + 5 ■ log |A'|)-close to Pabr- 
Hence we showed the existence of an (e + 5 • log |yl'|)-error Quantum State Splitting protocol with embezzling states 
for pAA'R with a quantum communication cost of 



{H^{A')p. - Hn,in{A'\R)p.) + 2 • log 



log [2 -log I A' I 



(29) 



where i G {0, 1, . . . , Q}. But by the monotonicity of the purified distance (Lemma A. 2 1, ( 25 ) and the triangle inequal- 
ity for the purifed distance, this implies the existence of an (e + S- log + |^|~^^-error Quantum State Splitting 



protocol with embezzling states for paa'r with a quantum communication cost as in (29) 
now 

Hmin {A' 



We now proceed with simplifying the expression for the quantum communication cost (29). We have Ho{A')pi 



1 for i = 0, 1, . . . , Q as can be seen as follows. We have 

1 



< 



2-^'+^^ < XnuniPA') < 



< 



Pa' 



< 2- 



rank (p*^,) 

where XminiPA') denotes the smallest non-zero eigenvalue of p\,. Thus rank {pa') ^ 2*+-'^ = 2* • 2 < tt— ^ 
is equivalent to the claim. 



and this 



Hence we get an {e + S ■ log + ^/^)-error Quantum State Splitting protocol with embezzling states for paa'R 
with a quantum communication cost of 



(ifmin(A')p. - -ffmin(^'|-R)p. + l) + 2 • log ■ 



log [2 -log I A' I 



Using a lower bound for the max-information in terms of min-entropies (Lemma B.IO) and the behavior of the 
max-information under projective measurements (Lemma B.I6I we can simplify this to 



< 



< 



1 



max _t max 
i Z 



/max (A' : i?)p. + 2 -log 



1 



1 1 



-/,nax(^' : i?)p-h 2- log - + 



hlog r2-iogi^'|- 

log [2 -log I A' 11 . 



It is then easily seen that 



q < 2-^max(^' : i?)p + 2 • log - + 4 + log log \A'\ 



As the last step, we transform the max-information term in the formula for the quantum communication cost into a 
smooth max-information. Namely, we can reduce the quantum communication cost if we do not apply the protocol as 
described above to the state paa'r, but pretend that we have another (possibly subnormalized) state paa'R that is 
e'-close to Paa'r and then apply the protocol for paa'R- By the monotonicity of the purified distance (Lemma A. 2 1, 



the additional error term that we get from this is upper bounded by e' and by the triangle inequality for the purified 
distance this results in an accuracy ofe + e' + S-\og \A'\ + \A'\-^/^. But if we minimize q over all paa' r. that are 
e'-close to paa'R, we can reduce the quantum communication cost to 



q < llL.{A' : i?)p + 2 • log i + 4 + log log l^'l 



(30) 



This shows the existence of an {e + e' + 6 ■ log \A'\ + \ A'\ ^/^)-error Quantum State Splitting protocol with embezzling 
states for paa'r for a quantum communication cost as in (30). □ 
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The following theorem shows that the quantum communication cost in Theorem III. 10 is optimal up to small additive 
terms. 

Theorem III. 11. Let e > and paa'R — \p){p\aa'R G S<.{'Haa'r)- Then the quantum communication cost for any 
e-error Quantum State Splitting protocoj^for paa'R. is lower bounded by 

9 > ■■ R)p • (31) 



Proof. We have a look at the correlations between Bob and the reference by analyzing the max-information that 
the reference has about Bob. At the beginning of any protocol, there is no register at Bob's side and therefore 
the max-information that the reference has about Bob is zero. Since back communication is not allowed, we can 
assume that the protocol for Quantum State Splitting has the following form: applying local operations at Alice's 
side, sending qubits from Alice to Bob and then applying local operations at Bob's side. Local operations at Alice's 
side have no influence on the max-information that the reference has about Bob. By sending q qubits from Alice 



to Bob, the max-information that the reference has about Bob can increase, but at most by 2q (Lemma B.7). By 



applying local operations at Bob's side the max-information that the reference has about Bob can only decrease 



(Lemma B.14). So the max-information that the reference has about Bob is upper bounded by 2q. Therefore, any 



state lobr at the end of a Quantum State Splitting protocol must satisfy /max(S : R)u> < Sg. But we also need 



lobr ~e Pbr = {^A'^B ®1r){pa' r) by the definition of e-error Quantum State Splitting (Definition III.9I. Using the 
definition of the smooth max-information, we get 

9 > ■■ R)p ■ 

□ 

IV. THE QUANTUM REVERSE SHANNON THEOREM 

This section contains the main result, a proof of the Quantum Reverse Shannon Theorem. The intuition is as 
follows. Let £a^b be a quantum channel with 

Ea^b: s={nA) ^ s={nB) 

pa ^ Ea^b{pa) , 

where we want to think of subsystem A being at Alice's side and subsystem B being at Bob's side. The Quantum 
Reverse Shannon Theorem states that if Alice and Bob share embezzling states, they can asymptotically simulate 
Sa^b only using local operations at Alice's side, local operations at Bob's side, and a classical communication rate 
(from Alice to Bob) of 

Ce = max/(B : i?)(£(S)i)($) , 

where ^ar is a purification of pA and we note that I{B : i?)(£(g)i)($) = H{R)p + H{B)ii(^p-^ — i?(i?-R)(£(gii)($). 

Using Stinespring's dilation [36| . we can think oIEa^b as 

£a^b{pa) = trc [{Ua-^bc)pa{Ua-^bc)^] , (32) 

where C is an additional register with |C| < and Ua^bc some isometry. The idea of our proof is to first 

simulate the quantum channel locally at Alice's side, resulting in psc = {Ua^bc)pa{Ua^bc)\ and then use Quan- 



tum State Splitting with embezzling states (Theorem III. 10) to do an optimal state transfer of the i?-part to Bob's 



side, such that he holds pB = £a^b{pa) in the end. Note that we can replace the quantum communication in the 
Quantum State Splitting protocol by twice as much classical communication, since we have free entanglement and can 
therefore use quantum teleportation [47 ,. Although the free entanglement is given in the form of embezzling states. 



maximally entangled states can be created without any (additional) communication (Definition III. 6 1 
More formally, we make the following definitions: 



^ We suppress the mentioning of any entanglement resource, since the statement holds independently of it. 
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Definition IV. 1. Consider a bipartite system with parties Alice and Bob. Let e >0 and £ : C{'Ha) — >■ ^{Hb) be a 
CPTP map, where Ahce controls "Ha and Bob Hb- A CPTP map 7^ is a one-shot reverse Shannon simulation for £ 
with error e if it consists of applying local operations at Alice's side, local operations at Bob's side, sending c classical 
bits from Alice to Bob, using a (S-ebit embezzling state for some 5 > Q, and 

\\P-£U<e, (33) 



where ||.||o denotes the diamond norm (Definition D.l ). c is called classical commimication cost of the one-shot reverse 
Shannon simulation. 

Definition IV. 2. Let £ : C{'Ha) ^ 'C('Hb) be a CPTP map. An asymptotic reverse Shannon simulation for £ is a 
sequence of one-shot reverse Shannon protocols V" for with error e„, such that lim„^oo = 0. The classical 
communication cost c„ of this simulation is limsup„_j.32 ^ — c. 

A precise statement of the Quantum Reverse Shannon Theorem is now as follows. 

Theorem IV. 3. Let £a^b '■ 'C('Ha) ^ 'C('Hb) be a CPTP map. Then the minimal classical communication cost 
Cqrst of asymptotic reverse Shannon simulations for £a^b is equal to the entanglement assisted classical capacity 
Ce of £a^b- That is 

Cqrst = maxI{B : R)(s«,x)i'S>) , (34) 
where ^ar = |^)(<I'Ufl € S={Har) is a purification of the input state pA € 5^("Ha)P°] 



Proof. First note that by the entanglement assisted classical capacity theorem Cqrst > Ce |2|j^ Hence it remains 
to show that Cqrst ^ Ce- 

We start by making some general statements about the structure of the proof, and then dive into the technical 
arguments. 



Because the Quantum Reverse Shannon Theorem makes an asymptotic statement, we have to make our considerations 

A^B lOr Oy^_^g 



for a general n S N. Thus the goal is to show the existence of a one-shot reverse Shannon simulation Va^b ^^r S*^" 



that is arbitrarily close to £a^b ^^"^ " ~^ ^ classical communication rate of Ce and works for any input. We 



do this by using Quantum State Splitting with embezzling states (Theorem III.IO), quantum teleportation |47] and 



the Post-Selection Technique (Proposition D.4|. 



Any hypothetical map Va^b (t^iat we may want to use for the simulation of £a^b)^ '^^'^ made to act symmet- 
rically on the n-partite input system H®" by inserting a symmetrization step. This works as follows. First Alice 
and Bob generate some shared randomness by generating maximally entangled states from the embezzling states 
and measuring their part in the same computational basis (for n large, 0(n log n) maximally entangled states are 
needed). Then, before the original map V\^g starts, Alice applies a random permutation tt on the input system 
chosen according to the shared randomness. Afterwards they run the map Va^b ^'^'^ then, in the end, Bob undoes 
the permutation by applying 7r~^ on the output system. From this we obtain a permutation invariant version of 
V^^g. Since the maximally entangled states can only be created with finite precision, the shared randomness, and 
therefore the permutation invariance, is not perfect. However, as we will argue at the end, this imperfection can be 
made arbitrarily small and can therefore be neglected. 



bit 



Note that the simulation will need embezzling states /iAcmbScnb ^'^d maximally entangled states I'/'m) (^mUobitS. 
(for the quantum teleportation step and to assure the permutation invariance) . But since the input on these registers 
is fixed, we are allowed to think of the simulation as a map Va^e, see Figure [Sj 



Let /3 > 0. Our aim is to show the existence of a map T^^-s-B' ^^^^ consists of applying local operations at Alice's 
side, local operation at Bob's side, sending classical bits from Alice to Bob at a rate of Ce, and such that 

l!f|"B-n^Bllo</3- (35) 



Since all purifications give the same amount of entropy, we do not need to specify which one we use. 

Assume that Cqrst 5: Ce — ^ for some 5 > and start with a perfect identity channel Then we could use Cqrst < C'e — S 

together with the entanglement assisted classical capacity theorem to asymptotically simulate the perfect identity channel at a rate 
Q^^l > 1; a contradiction to Holevo's theorem [3l I46|. 
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/>m)(0mUobitBob,t 



Pa- 





embezzling map 

X 








(a) 





























PA,.,„b-Bomb 

m I A(.bit-Sebi1 



FIG. 3. (a) X is the map that embezzles m maximally entangled states |(/'m)((/>m|A„bitS„bit of A'A^^bS^n^b • These maximally 
entangled states are then used in the protocol, (b) The whole map that should simulate £^^b takes ® MAcmbSomb ® 
|<^m){<^m|Aebitflebit with p\ £ S={'H^") as an input. But since this input is constant on all registers except for A, we can think 
of the map as in (c), namely as a CPTP map Va^b which takes only the input p5.- 



Because we assume that the map V^^^g is permutation invariant, we are aUowed to use the Post-Selection Technique 
(Proposition D.4|. Thus ([35]) relaxes to 



- Pl^s) ® Ibm'KQrr^) 111 < Pin + l)-(l^l'-i) 



(36) 



where Carr' ^ purification of (2r — I <^AR'^i^AR), i^ar — \'^){i-^\ar G S^iT-LAR.) and d{.) is the measure on the 
normalized pure states on Har. induced by the Haar measure on the unitary group acting on Har, normalized to 



To show (361, we consider a local simulation of the channel S'^^b Alice's side (using Stinespring's dilation as 
in (32)) followed by Quantum State Splitting with embezzling states. Applied to the de Finetti type input state 



^ARR' ' obtain the state 

CbCRR! = m^BC ® ^RB'KlRR'm^sC ® ^RR')^ ■ 

As described above, this map can be made permutation invariant (cf. Figure |4]). 

Now we use this map as (7^^ ^ ® I rr' ) in (|36]) We obtain from the achievability of Quantum State Splitting with 
embezzling states (Theorem III.IO) that 



P {{Sf!^B®^RR'){CARR-). {V1^b®^RR')[Carr')) <e + e' + 5n -log \B\ + \B\-'^ 
for a quantum communication cost of 

9n < ■■ i?i?')(£»"CSi)(C") + 2 • log J + 4 + logn + log log \B\ . 



(37) 



Because the trace distance is upper bounded by two times the purified distance (Lemma A.l), this implies 

II ((^1:;^ - n^B)^^RR')iQRR')l < 2(e + e' + 6n- log \B\ + \B\-"/') . 
By choosing e — e' and 6 — ^ we obtain 

imf^B-'p''^ 



A-^B) 



'-RR 



)(CW)lli<6e' + 2.|sr"/2 



So far this map needs quantum communication, but we are going to replace this by classical communication shortly. 
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Irr'{Carr'. 




FIG. 4. A schematic description of the protocol that is used to prove the Quantum Reverse Shannon Theorem. The channel 
simulation is done for the de Finetti type input state CAflij'- Because our simulation is permutation invariant, the Post-Selection 
Technique (Proposition D.4I shows that this is also sufficient for all input states. The whole simulation is called "P" in the text, 
(i) and (ii) denote the subroutine of Quantum State Splitting with embezzling states and quantum teleportation; with local 
operations on Alice's and Bob's side and a classical communication rate of c„. 



Furthermore we choose e' — + 1) ^l'^' — ||-B| "^^ (for large enough n) and hence 
This is (36) and by the Post-Selection Technique (Proposition D.4[ ) this implies (35). 

But the map {V^l^g ® Irr' ) uses quantum communication and we are only allowed to use classical communication. 
It thus remains to replace the quantum communication by classical communication and to show that the classical 
communication rate of the resulting map is upper bounded by C^;. 



Set X = 2 • log jr + A + logn -I- log log \ B\. It follows from (37 1 and below that the quantum communication cost of 
{Va^b ®'^RR') is quantified by 

q-n < 2-^max(^ ■ ^^')(£»"«>I)(C") + X ■ 

We can use quantum teleportation [47] (using the maximally entangled states |0m)('/'mUcbitBcbit) to transform this 
into a classical communication cost of 

C„ < /inax(-S : -R-R')(£®"«ii)(C") + 2X • 



By the upper bound in Proposition B.9 and the fact that we can assume |i?'| < {n + 1)^^^ ^ (Proposition D.4), we 
get 



Cn < iLAB ■■ i?)(£«"»i)(C") + 2 • log +2x< iLAB : i?)(£«"«i)(C") + 2 • log \{n + 



2x 



By a corollary of Caratheodory's theorem (Corollary |D.6[), we can write 



CXr = Y.p^{.^ 



ARl 
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where = \^^){^^\ar & S={Har), i & {l,2,...,(n + l)2|-4||fi|- 2} ^ probability distribution. Using a 

quasi-convexity property of the smooth max-information (Proposition B.18) we then obtain 



C« < I^axiB ■■ -R)(f»"(g.I)(X:.p.($»)»") + 2 • log 

< max/^^^(S : + log 

< max/,^^^(S : + log 



(n + 1)1^1'-! 

(„+l)2|A||i^|-2- 
(„+l)2|A||fl,k2- 



-2x 

-2 -log 1)1^1' 
2 -log [(n + 1)1^1'- 



h2x 
2x, 



where the last maximum ranges over all ^ar = \^){^\ar € S={Har)- 

From the Asymptotic Equipartition Property for the smooth max-information (Lemma B.21 ) we obtain 



c„ < n • max/(B : + V" • ^(e') - 2 • log — + log 



(n + 1) 



2|A||i?.|-2 



2 • log 



(n + 1) 



2x , 



where $(e') = 8^/13 - 4 • log e' • (2 + i • log \A\). Since e' = |/3(n + 1)"'!-^!'"!) - the classical communication 

rate is then upper bounded by 

c — limsuplimsup — < max/(i3 : i?)(£(g)i)($) . 

P^O n-i-oo n * 

Thus it only remains to justify why it is sufficient that the maximally entangled states, which we used for the 
quantum teleportation step and to make the protocol permutation invariant, only have finite precision. For this, it 
is useful to think of the CPTP map V^^^ that we constructed above, as in Figure [3](b). Let e" > and assume 
that the entanglement is e"-close to the perfect input state MAo„bBomb ® l'^m)(</'mUebitBobif The purified distance is 
monotone (Lemma A. 2 1 and hence the corresponding imperfect output state is e"-close to the state obtained under 
the assumption of perfect permutation invariance. Since e'" can be made arbitrarily small (Definition IIL6), the 
CPTP map based on the imperfect entanglement does the job. 

□ 
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Appendix A: Properties of the Purified Distance 

The following gives lower and upper bounds to the purled distance in terms of the trace distance. 
Lemma A.l. [3^1 Lemma 6] Let p, <t E S<:{'H). Then 

I'Wp- < P{P,<J) <V\\P- + ItrM - tr[a]| . (Al) 



The purified distance is monotone under CPTP maps. 

Lemma A. 2. (39l Lemma 7] Let p, (J E S<:{H) and £ be a CPTP map on H. Then 

P{£{p),£ia))<P{p,a) . 



(A2) 
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The purified distance is convex in its arguments in the fohowing sense. 

Lemma A. 3. Let pi, ui G S<{'H) with pi for i G / and pi a probabihty distribution. Then 



(A3) 



Proof. Let p = J^ieiPiPi ^^'^ ^ l^ieiPi'^i ^'^'^ define p — p (S (1 — tr[p]), a — p (3 (1 — tr[(T]) as well as 
Pi = Pi ffi (1 — tr [pi]) and (Ji — ai (1 — tr [cTi]) for all i £ I. 



By assumption we have F {pi^di) > ^/\ — for alH e / and using the joint concavity of the fidelity [46] we obtain 

P{p,a) = ^l-F^ (p,a) 



\ 



\iei iei I \ Vie/ 



PiF{p^,ai) <e. 



□ 



Appendix B: Basic Properties of Smooth Entropy Measures 
1. Additional Definitions 

Our technical claims use some auxiliary entropic quantities. For pA G S<{'Ha) we define 



1/2 

Pa 



i?max(A)p = 2 • logtr 
Ha{A)p = logrank(pA) 
Hr[A)p = - sup {a e M : pa > 2^ • p\] , 

where i?max(^)p is called max- entropy. For £ > 0, the smooth max-entropy of pA G S<:{'Ha) is defined as 

Hl^AA)p= inf i/,„ax(A)p. 

The conditional min-entropy of pab G S<{'Hab) relative to ub G S={'Hb) is given by 
The quantum conditional collision entropy of A given B for pab G S<{Hab) is defined as 



Hc{A\B)p = - inf logtr 



((1a ag^^)pABilA ® CTb^^'^) 



where the inverses are generalized inverses 

As in I18j we define the min-relative entropy of p £ S<{'H) with respect to a £ 'P{'H) as 

£'min(p|k) = -logtr [p"cr] . 



(Bl) 
(B2) 
(B3) 



(B4) 



(B5) 



(B6) 



(B7) 



For p £ 'P('H), p ^ is a generalized inverse of p if pp ^ = P ^ P = = (p ^)'^- 
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2. Alternative Formulas 

The max-relative entropy can be written in the following alternative form. 
Lemma B.l. [T?, Lemma B.5.3] Let p £ S<{H) and <j G V{T-L) such that supp(/3) C supp((T). Then 

A„ax(p|k) =l0g||a-l/V^"'/'l|co 

where the inverses are generalized inverses. 

Using this we can give an alternative expression for the max-information. 
Lemma B.2. Let pab G S<{'Hab)- Then 

-^max(^ : B)p = Ho{A)p — H„iin{A\B)p^^^ 
where Pb\a = (PA 8) 1b)~^^^ iank{pA) ® Is)^"'^^'^ and the inverses are generalized inverses. 



(B8) 



(B9) 



Proof. Without loss of generality we can restrict the minimum in the definition of the max-mutual information to 
ub G S={'Hb) with supp(/9^b) C supp(p^) (g) supp(crB). To see this note that £'max(PAB||PA ® Pb) is finite but 
Dma.yi{pAB\\pA ® (T b) = oo for any CTs e S={T-Lb) with supp(pAs) ^ supp(/9a) ® supp(a-B). 



Therefore we can use Lemma [B. II 

/max(A : B)p = minlog [pA crBy'^''^ Pab{pa ® (Jb)^'^''^ 



min log 



1. 



{^^^^aBr"\pA®iBr'''^^APA®iBr''\- . 

rank(p^) rank(p^) rank(p^) 



We have pb\a = [pA ® lj3)''^ %ank(p^) (P^ ® ^b)'^'^ e S={nAB) because 

'{Pa^ (g) 1b)pab 



tr [pb\a] = tr 



rank(pA) 



tr 



Pa^Pa 
rank(p^) 



Hence we can write 



-^max(^ : B)p = min Anax(psM|| TT — V 

o-B ' rank(p^j 



.as) =iJo(A)p-i?min(^|S) 



Pb\a ■ 



0-B 



-1/2 



□ 



3. Upper and Lower Bounds 

The conditional min-entropy is upper bounded by the quantum conditional collision entropy. 
Lemma B.3. Let pab G S<{'Hab)- Then 

H„.UA\B)p < Hc{A\B)p . 



(BIO) 



Proof. Let (Jb G S^{'Hb) be such that H^ia{A\B) p = — -Dma x(PA _B||PA <^b)- We know that supp(p^B) C 1^ (g) 
supp(crB) (argumentation analogue as in the proof of Lemma B.2) and hence we can use the alternative expression 
for the max-relative entropy (Lemma B.l ) 



Hnun{A\B)p 



log max tr 



^AB 



{1a ® cJb'''^) pab (l. 



-1/2 
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Pae 



€ S^CHab) we have 



But for pAB - ti^i^ 

HciA\B)p ^ -log min tr p^s ( 1^ (g) k^^^^ ) p^s ( 1a «) 



/2 



> — loK tr 



PAB «) cr^^^^) PAS ® cr^^^^ 



logtr [pab] - logtr p^s (1a «) 0-3^^^) Pas (1a ® cr 

WAS cr^^^^) PAS 8) (^B^ 



1/2 



> — log max tr 



The max-relative entropy is lower bounded by the quantum relative entropy. 
Lemma B.4. [T^, Lemma 10] Let p, cr G 5<('H). Then 

Anax(p||CT) > . 



S 

-1/2 



i/min(A|B) 



□ 



(Bll) 



The min-relative entropy is nonnegative for normalized states. 

Lemma B.5. [18, Lemma 6]. Let p, <t E S={H). Then Uminlpllc) > 0. 

From this we find the following dimension lower bounds for the conditional min-entropy. 

Lemma B.6. Let pab G S<{'Hab)- Then 

-logl^l <i7„,i„(A|B)p|p 

- log \A\ < H,^in{A\B)p + logtr[pAs] • 



(B12) 
(B13) 



Proof. Let pabr G S<{%abr) be a purification of pab and define pabr — tilpABR] ^ S={T~Labr)- By a duality 
property of min- and max-entropy [151 Proposition 3.10] we have 

i/min(^|S)p|p = min Anin(PA7?||lA fX" CTfl) ■ 



Using the nonnegativity of the min-relative entropy for normalized states (Lemma B.5I we obtain 



0< min i^min PAflll 7-77 "XjCTfl ^ log I A|-t- min Z^niin (PAi?|l 1a «) ^7?) = log |^| + i/,nin(A|B)^|^ 

CReS^iHR) \ \A\ J uaeS^iHR) 



= \og\A\+H^-MB) 



Inequality (B13) is proved in [3SJ Lemma 20]. 

The following dimension upper bound holds for the max-information. 
Lemma B.7. Let pab G S<{'Hab)- Then 

/max(^:-B)p<2-logmin{|Al,|Bl} 



□ 



(B14) 



Proof. It follows from the dimension lower bound for the conditional min-entropy (Lemma B.6) that 

/,nax(^ : B)p < Anax (^PAbWpA ® ^) = log \B\ - F^^in (S ] < 2 • log \B\ . 



Using the alternative expression for the max-information (Lemma B.2) and again Lemma B.6 we get 



/max(A : B)p = Ho{A)p - H,,,in{A\B)p < 2 • log \A\ . 



□ 
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Remark B.8. In general there is no dimension upper bound for -Dmax(pAs||pyi Pb) as can be seen by the following 
example. Let pab = \p){p\ab G S={'Hab) with Schmidt-decomposition \p)ab = X^i^^iW^® Then 

-Dmax(pAB||pA«)pB) =log ^^A-l^ , (B15) 

where the sum ranges over all i with Xi > 0. 

The following is a bound on the increase of the max-information when an additional subsystem is added. 
Lemma B.9. Let e > and pabc G S={'Habc)- Then 

Il^M ■■ BC)p < Il,^{A : + 2 • log \C\ . (B16) 



Proof. Let pab e B^{pab) and ctb G S={Hb) such that /,nax(-4 : -B)p = -Dmax (pas||/5a ® 0-5) = log/i. That is, /i 
is minimal such that p ■ pa ® <^b > Pab and this implies p ■ pa ® f^B ® > • Pab (81 Ic- Furthermore define 
PABC G 13^ (pabc) such that trp [pabc] = Pab (by Uhlmann's theorem such a state exists [i^ 



By the dimension lower bound for the min-entropy (Lemma B.6), we have H,^i,^{C\AB)p\p > — log|C|. Therefore 
\C\ ■ Pab ^ Ic > Pabc and hence p ■ pa 0-3 ^ > • Pabc- 

Now let Dmax (^PabcWpa ® ctb ® = log A. That is, A is minimal such that A • pA ® o'b (X" ypj" — Pabc- Thus it 
follows that A < /i • |Cp and from this we get 

r„,,^{A : BC)p < i^max (pabcWpa ^b ^ j < ^max {pab\\pa ® ^b) + 21og \C\ = /^,ax(^ -3)^ + 2- log \C\ . 

□ 

The max-information can be lower bounded in terms of the min-entropy. 
Lemma B.IO. Let pab G S<{'Hab)- Then 

/max(A : B)p > H,^^{A)p - H^^{A\B)p . (B17) 



Proof. Let gb G S={'Hb) such that /max(^ '- B)p = I?rnax(/OyiB||PA (7b) = log A. That is, A is minimal such that 
\ - Pa® ^B ^ Pab- Furthermore let p be minimal such that p - \\pA\\rx, ' Ia^^s > Pab- 

Since UpaHoo • Ia > PA, we have that X > p. Now set i7niin(^|5)p|5- = ^ log ly, i.e. is minimal such that • 1^ ^ctb > 
Pab- Thus — p - \\pa\\oo and we conclude 

/max(^ : B)p = log A > logAi = - log \\pa\\oc + logi' = i?,„i„(A)p - iJmi„(^|S)p|^ > i?,„i„(A)p - iJmi„(^|S)p . 

□ 

The max-information can be upper bounded in terms of a difference between two entropic quantities. 
Lemma B.ll. Let pab G S<{'Hab)- Then 

/max(A : B)p < Hr{A)p - H^-,i,,{A\B)p . (B18) 



Proof. Let Itb G S={'Hb) such that Hi^{-a{A\B)p = _ffi„i,i(j4|_B)p|5. = — log/i. That is, p is minimal such that 
p - 1a® Ob > Pab- Since multiplication by (g) 1^ docs not affect pab (note that the support of pab is contained 
in the support of ^ Pb), we also have p - p'a® <^b > Pab- 

Furthermore pA > Amin (pa) ■ p'a where Aniin(p) denotes the smallest non-zero eigenvalue of p. Therefore ^ -^(p^) ' PA® 

ctb > PAB- Now let Anax(pAs|pA'8)CTs) = log A, i.e. A is minimal such that \- pa®(^b > Pab- Hence A < p- X^lniP^) 
and thus 

/max(^ : B)p < D^^^{pab\pa ® 5-b) < Hii{A)p - H„,i^{A\B)p . 

a 
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This can be generalized to a version for the smooth max-information. 
Lemma B.12. Let e > and pab G S={Hab)- Then 



: B), < HC/f{A)p KJfiAlB), - 2 • log - . (B19) 



Proof. By the entropy measure upper bound for the max-information (Lemma B.ll) we obtain 



: B)p < min [Hn{A)p - H^i^{A\B)p] 

PABeB^(pAB) 



< min {m:in[Hii{A)iiAu:iiA- H.^in{A\B)iiAu:iiA\ \ , 

U^ABeB^^/^HpAB) I "a J 

where the minimum ranges over all < Ha < such that IIa(^ab^a ~e/2 ^ab- Now we choose as G S={'Hb) such 
that Hi-am[A\B)^\^ — Hi-aii-i{A\B)^ and use Lemma 



B.24 



to obtain 



IL^AA--B)p< niin <^ min [i/7?(A)n^„n^ - iJ,„in(^|5)n^a;n^|*] ^ 

^ABeB'-^'''>'(pAB) I "a J 

< min I min - i/min(^|S)u;|cr 



= min <^ min [Hr{A)iiau,iIa] - H.^i^{A\B)^ 

^ABeB'^'^^'ipAB) I "a 

where the minimum ranges over all < Ha < 1a such that n^ajyisn/i ~e/2 ^ab- As a next step we choose 
WAS = Cjab e B'"'^\pab) such that = H^^(A\B)i,. Hence we get 

Il^M ■■ B)p < min [Hn{A)nA^UA] ' H'lI^\A\B)p , 



where the minimum ranges over all < Ha < 1a such that n^w^sllyi ~e/2 i^ab- Using Lemma B.25 we can choose 

< 

obtain 



< Ha < 1a with HaujabHa ~e/2 ^^ab such that i?fl:(A)n^cDn^ < ffma4^''(v4)<i - 2 • logf^. From this we finally 



Il^M ■■ B)p < H^^l^\A)^ - hU'\A\B)p - 2 . log - < Htl^\A)p - HUf{A\B)p - 2 • log - 



□ 



4. Monotonicity 

The max-relative entropy is monotone under CPTP maps. 
Lemma B.13. |18l Lemma 7] Let p,a e V{H) and £ be a CPTP map on %. Then 

^max(plk) > A„ax(f (p)||f (a)) . (B20) 

It follows that the max-information is monotone under local CPTP maps. 

Lemma B.14. Let pab G S<{T-Lab) and T be a CPTP map on T-Lab of the form £ — £a® £b- Then 

In.UA ■■ B)p > I^^A : . (B21) 



Proof. Let ctb G S^{'Hb)- Using the monotonicity of the max-information under local CPTP maps (Lemma B.13) we 
obtain 



-fmax(^ : B)p = Anax(/5AB||PA ® ^ b) > Drni,^{£ {pab)\\£a{Pa) <8)fB(CTs)) 

> 

= Anax(^ : B)£j^p) 



> min D^U£{pab)\\Sa{pa)<^^b) 

t^Bes=(HB) 



□ 



23 



5. Miscellaneous Properties 

The max-information of classical-quantum states can be estimated as follows. 

Lemma B.15. Let pabi e S<{Habi) with pabi = J2ieiPiPAB <^ Pab S<{Hab) and > for z e / as 

well as the \i} mutually orthogonal (i.e. the state is classical on /). Then 

ImU^I ■■ B)p > max/„,ax(^ : . (B22) 

Proof. Let G S={%b) such that /max(j4/ : B)p = -Dmax(PAS/||PA/ ® ^b) = log-^- That is, A is minimal such that 

A • ^Pip\®crB «) > ^PiPAB «> ■ 

i i 

Since the |i) are mutually orthogonal and pi > for i e /, this is equivalent to Vi G / : A • (8) ctb > Pas- 
Set -Dmaxlp^sll/'A ® ^-b) = log Ai, i.e. is minimal such that Ai • ® ctb > Pab- Hence A > maxig/ Ai and therefore 
ImaA^I ■ B)p = logA > maxAi = max Anax(PABllPA ® ^s) > max/max(^ : B) , . 

□ 

From this we obtain the following corollary about the behavior of the max-information under projective measurements. 

Corollary B.16. Let pab & S<{Hab) and let P — {^^lig/ be a collection of projectors that describe a projective 
measurement on system A. For tr [P^Pab] 7^ 0, let Pi = tr [P^pab] and p\g — ^P\pabPa- Then 

/max (A : B)p > max /max (A : B)^. , (B23) 
where the maximum ranges over all i for which p\g is defined. 

Proof. Define a CFTP map E : S<{Hab) ^ S<{nABi) with £{.) = [Pa{-)Pa\ ® whe re the \i) are mutually 



orthogonal. Then the monotonicity of the max-information under local CFTP maps (Lemma B.14) combined with 



the preceding lemma about the max-information of classical-quantum states (Lemma B.15 1 show that 

/max 

{A : B)p > I^^^{A : B)£(^p) > max/niax(^ : B)p^ . 

□ 

The max-relative entropy is quasi-convex in the following sense. 

Lemma B.17. [HI Lemma 9] Let p = J2ieiPiPi ^ S<{'H) and a = J2ieiPi'^i ^ S<{'H) with pi,ai G S<{T-L) for z G /. 
Then 

£'max(p|k) < max Anax(Pj II CTj) • (B24) 

From this we find the following quasi-convexity type lemma for the smooth max-information. 
Lemma B.18. Let e > and pab = J2iei PiPab S<{'Hab) with p\g G S<{'Hab) for i G / . Then 

/^ax(^ : B)p < max/^ax(^ : B)p, + log |/| . (B25) 
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Proof. L et p\ f^ €E B'^{p\g) and a-g € S={Hb) for i £ I. Using the quasi-convexity of the max-relative entropy 



(Lemma B.17I we obtain 



max/^^^(A : + log |/| = maxi:*^^^ {pabWPa ^s) + log |/| > -Dmax Vp./5^bII J^P'Pa <»^h)+ log |/| 

Vie/ lei / 

= logmin i A e M : ^p^PAB < A • JI?'*^^ «) > + log |/| 

> logmin J // e M : ^P^p\B < M ' Xl^*'"^ ®^^% \ +^og \I\ 
y iei iei jei J 

= logmin i /i e M : ^p^p^s < M ' Xl^'^^ ® 51 j ' f ' 
[ iei iei jei J 

where step (i) holds because Y^ieiP^PA Lje/^s > Y^teiP^PA ^b- Now set = X^je/ T ' ^"^^ Pab 



^iei PiPAB- convexity of the purified distance in its arguments (Lemma A. 3 1 we obtain 



max/,';jax(A : B) ^ + log |/| > logmin {/.t G M : pAB < p- PA® ctb} 



> min min logminjj/ G M : pab <v-pA® ctb} = /,^ax(^ • B)p 

Pab€B'{pab) ctb^S^CHb) 



□ 



6. Asymptotic Behavior 

The following is the Asymptotic Equipartition Property (AEP) for smooth min- and max-entropy. 
Lemma B.19. [31 Theorem 9] Let e > 0, n > 2 • (1 - e^) and pab e S={T-Lab)- Then 

-i?5.in(^|S)p«" > H{A\B), - ^ (B26) 
-i/^,,(A),«„ < H{A), + ^ , (B27) 

where 7y(e) = 4^1 - 2 • loge • (2 + ^ • log |A|). 

Remark B.20. [Ml Theorem 1] Let pab e S={Uab)- Then 

lim lim -iJ^i„(A|B)„g,„ = F(A|S)„ (B28) 

e— n— >-oo n 

hm lim -i75_(^),«„ = iJ(A)p . (B29) 



The Asymptotic Equipartition Property for the smooth max-information is as follows. 
Lemma B.21. Let e > 0, n > 2 • (1 - e^) and pab e S={'Hab)- Then 



^ Il,^{A : < /(A : B), + ^ - ^ . log 1^ , (B30) 



where ^(e) = 8Vl3-4-log£ • (2 + i • log \A\). 
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Proof. Using the entropy measure upper bound for the smooth max-information (Lemma B.12) together with the 
Asymptotic Equipartition Property for the smooth min- and max-entropies (Lemma B.19I we obtain 



e 



n 



fog 
n ^24 



<HiA)p-HiA\B)p--.los-+2.-^Jl-lo, 



< HA : B) 



as 



^ — ■ fog — 



Corollary B.22. Let pab e S^CHab)- Then 



lim lim -/^,,(A : = I{A : B)p 

e— >-0 n— >-oo n 



fog(2 + - - foglAI) 



□ 



(B31) 



Proof. By the Asymptotic Equipartition Property for the max-information (Lemma B.21) we have 

hm hm -I^^M ■■ B)p^^ < I{A : B)p + hm hm fog — 

where $(e) = 8Vl3-4-foge • (2 + i • log \A\). Thus we obtain 

hm lim -r^,^{A : B)p^,. < I{A : B)p . 

To show the converse we need a Fannes-type inequality for the von Neumann entropy. We use Theorem 1 of [JS] : Let 
p, cr £ S^{'H) with p a. Then \H{p) — H{a)\ < £log(d — 1) + H{{£, 1 — e)), where d denotes the dimension of H. 



Because the max-relative entropy is always lower bounded by the relative von Neumann entropy (Lemma B.4[ ) we get 



^max(^ : 5)p®" = min min Anax {PabWPa ® <^b) > min min ^'(pasII/Oa «) ffg) . 

Noting that Z3(pyiB||p^ (g) ctb) = £'(pyiiB||pyi ® ps) + D{pb\\o'b) and using the Fannes type inequality we then obtain 
lim lim -/^ax(^ : ^)p»" > 1™ lim - min Dip'%s\\p'X ^ p^) 

> lim Jim i {7^(plS||pr ® pI") - 3 • H{{s, 1 - e)) - e ■ log [|Ar|B|" -!]-£• log -!]-£• log - 1]} 
>i^(pAB||p^$5pB)- Hm lim { - ■ H{{e,l - e)) - e ■ {\og[\A\\B\] + \og\A\ + \og\B\}] = I{A : B)p . 

□ 



7. Technical Lemmas 



Lemma B.23. [Ml Lemma A.7] Let p e S<{H) and U e ■?{%) such that H < 1. Then 



P(p,npn) < tr[p]-i/2 . ^tr[p]2 - tr[nV]2 . 



(B32) 



Lemma B.24. Let pab G S<{'Hab), (^b,^b G S={'Hb) and < II^b < l^s with l^^a;^ — n^s(lA®crs)nAB > 0. 
Then 



> H„,;n{A\B)pla 



(B33) 
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Proof. Set H^i-n{A\B) p\cr = ~ log A, i.e. A is minimal such that \ -1a®cfb — Pab > 0. Hence A • 11^13(1^1 0-5)11^13 — 
^abPab^ab > 0. Using 1^ ® - Has (1a ® 0-5)11^5 > we obtain 

A • 1a «) - HabPAB^AB = a • (1a «) - nAs(lA ® crB)nAs) + A • Has (1a 0-s)nAB - nAB/OAsIlAS > . 

The claim then follows by the definition of the min-entropy. □ 
Lemma B.25. Let e > and E S<{T-La)- Then there exists < Ha < 1a such that pA ~e IIaPaIIa and 

Ht^HiA), > Hn{A)npn + 2 • log ^ . (B34) 

Proof. By [49l Lemma A. 15] we have that for S > and pA G S<{Ha), there exists < Ha < 1a such that 
tr [(1a - Ul) pa] < 3S and ffLx(^)p > i^fl.(^)npn - 2 • log f 



Furthermore Lemma 
the proof. 



B.23 



shows that tr [(1a — Ha) Pa] < 3(5 implies pA ~ ygj HaPaIIa- For e — VOS this concludes 

□ 

Appendix C: Proof of the Decoupling Theorem 

Let A' be of the same dimension as A. Denote by Faa' the the swap operator of A (g) y4'. Let Hj^ be the projector 
on the symmetric subspace oi A^ A, and the projector on the anti-symmetric subspace oi A(E) A. We need the 
following facts (see also 31j). 

• Faa'rr' — Fa A' (8) Fjiji> 

. rank(n±) = |A|(|A|±l)/2 

. F2 = 1 

• n± = i(lAA'±i^AA') 

• tr [Faa'] = \A\ 

• tr [(tAa (j)A')FAA'] = tr [ipAfpA] 

• tr [(V-Ai? ® i^A'R') ■ (Iaa' ® = tr [^/-l] 
Lemma C.l. Let A = A1A2. Then 

/ {U^U)^{lA,A,,^FA,AOiU^U)dU<j^lAA' + T^^FAA', (CI) 
J(7(A) l^ll l^2| 

where dU is the Haar measure over the unitaries on system A. 

Proof. For any X that is Hermitian, it follows from Schur's lemma that 

(C/^ t/^)A(t/ f7)dC/ = a+(A)n;^ + a_(A)n^ , 

c/(A) 

where a±(X) • rank(n^) = tr[AnJ]. Choosing X = G = IasA^ ® -FaiA; we get 

tr [n±(lA,A^ ® ^^AiA;)] = ^tr [(Iaa' ± Faa')(1a.a;, ® i^AiA'J] 

= ^tr [lA.Ai ® J^AiA'J ± ^tr [FAA'(lA.Ai ® ^^AiA'j] 

= i|A2MAii±i|A2i-iAir 
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Since rank(n^) = l\A\{\A\ ± 1) we get 



a±(G) 



|A2|2|Ai|±|A2||Ai|2 \A2\±\A,\ 



mA\±i) 



\A\±l 



From 



and 



a+iG) + a_{G) 1 f [A^l + \A,\ lA^l - \A,\\ \A2\\A\ ~ \A,\ 1 \A\^ ~ \A,{' ^ 1 



1^1 + 1 



+ 



|A|-1 



< 



\A\^-1 \A,\ lAp-l -\A,\ 



a+iG)-a^{G) _1 f\A2\ + \Ai\ lA^] - \Ai\\ _ \Ai\\A\ - \A2\ _ 1 - jA^P ^ 1 



1^1 + 1 \A\-1 



follows that 



U{A) 



{U^ (g,U^)G{U(g)U)dU ^a+iG)U+ + a_{G)n^ = 



■cc 



\A\^-l - \A2 

a+{G)-a^{G) 




cc 



Lemma C.2. Let par e ViUAR), A = and crAii?(C/) = tr^, [{U ® lR)pARiU ® IrY] ■ Then 

1 



/ tr [aA.RiUy] dU < ^tr [pj,] + -^tv [p\j,] , 

Ju(A) l^ll l^2| 



/;7(A) 

where dU is the Haar measure over the unitaries on system A. 
Proof. Using Lemma |C.1| we have 



/ ti [aAMUf] dU ^ f tv[{aAMU)(^aA'^R'iU))FA,A[RR']dU 

Ju(A) JU(A) 

tr [iU ®U ®1rr^'){par® PA'R'){U ®U ®1rr')\1a^A'^® Fa.a'.rr')] dU 
[U ® U)\1a,a', ® FA.A'JiU ® U)dU ® Fnn' 



tr 



U{A) 

(par <^ PA'R') 



< tr 



(par (8) PA' 



R' 



U(A) 



^tr + ^tr 



Lemma C.3. T?, Lemma 5.1.3] Let be a Hermitian operator on % and ^ G V{H). Therp^ 



l^l|i<yMO 



^-1/4^^^1/4 



Proof of Theorem III. 1 We show 



log 1^1 1 < 



\og\A\+Hc{A\R)p 



□ 



(C2) 



□ 



(C3) 



which is sufficient because the conditional min-entropy is upper bounded by the quantum conditional collision entropy 
(Lemma B.3). Using Lemma C.3 with ^ = Ia^ <E) lor for ojij E S={Hr,), it suffices to show that 

^2 



U{A) 



<8) ujR^^'j (aA^RiU) - TAi <8) Pr) (1ai ® ^^k^^") 



dU <m 
2 l^il 



The Hilbert-Schmidt norm is defined as ||r||2 = Jtr [Ptr]. 
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We have 



(l^, (g) w^^/'') (JaMU) ® ^li'^) = tr^^ [{U ® 1r) {1a ® ^b^'^) Par (1a ® '-^r^'^) (U «) 1^)^ 

Let PAR = (Ia ^R^^^^ Par (1a » ^^r^^^^ and aAiR{U) = tr^^ [(?7 «) lfl)/5A_R(?7 1_r)^] ■ Our inequality can then 
be rewritten as 



U(A) 



s 

\\^Air{U) - TA, «) PRWldU < 



Using (S) Pr = dAtR{U)dU we get 



;7(A) JU{A) 



I 

JU{ 



tr 



UiA) 



{tr [CTA,i?(C/)2] - tr [aA,RiU)iTA, «) Pfl)] - tr [{ta, ® pR)aA,RiU)] + tr [{ta, ® Pr^] } dC/ 



tr [dA.RiU)^] dU - tr [{ta, ® Pi?)'] = / tr [^A^RiUf] dU - -— ■ ii 

[/(A) JU{A) l^ll 



1 



(i) 1 



(ii) 



where (i) follows from Lemma C.2 and (ii) follows from (C3) and the definition of Hc{A\R) 



□ 



Appendix D: The Post-Selection Technique 



We use a norm on the set of CPTP maps which essentially measures the probability by which two such mappings 
can be distinguished. The norm is known as diamond norm in quantum information theory |35) . Here, we present it 
in a formulation which highlights that it is dual to the well-known completely bounded (cb) norm . 

Definition D.l (Diamond norm). Let Ea '■ ^{'Ha) ^ ^{'Hb) be a linear map. The diamond norm of £a is defined 
as 



sup \\£A<E)Ik\\i 



(Df) 



where \\J^\\i = S'^^>cres<('H) ll-^(''')lli and Ik denotes the identity map on states of a fc-dimensional quantum system. 



Proposition D.2. [35l|50] The supremum in Definition D.f is reached for k = \ A\. Furthermore the diamond norm 
defines a norm on the set of CPTP maps. 

Two CPTP maps £ and T are called e-close if they are e-close in the metric induced by the diamond norm. 
Definition D.3 (Dc Finetti states). Let a E S={H) and fi{.) be a probability measure on S={H). Then 



J (T®"M(f^) e 5=(H®") 



(D2) 



is called de Finetti state. 

The following proposition lies at the heart of the Post- Selection Technique. 

Proposition D.4. [p Let e > and fJJ and be CPTP maps from CiUf ) to C(Hb)- K there exists a CPTP 
map for any permutation vr such that (£^ — J^^) o tt = o (£2 — J-a)i then £2 and are e-close whenever 



\\m - T:i)^iRR,)iaRR-)h < + i)-(i^i^-i) 



(D3) 



where Carr' is a purification of the de Finetti state = / a'^'^d{aAR) with ctar — \a-){a\AR G S={'Ha ® T~1-r), 
Ha = y-R and d{.) the measure on the normalized pure states on Ha ^ Hr induced by the Haar measure on the 
unitary group acting on Ha "8) Hr, normalized to J d{.) = 1. Furthermore we can assume without loss of generality 
that \R'\ < (n + iy^^'-K 
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Theorem D.5. [5T1 Caratheodory] Let d gN and x be a point that Hes in the convex hull of a set P of points in K''. 
Then there exists a subset P' of P consisting of d + 1 or fewer point such that x lies in the convex hull of P' . 



Corollary D.6. Let Qi?, = / o-fS^l^^fl) as in Proposition D.4 Then Qr = J2zP^{^ar) 

with uj\j^ = 

\uj'){lj'\ar e S={Har), i € {1,2, ... , (n + ^^^^ p. ^ probability distribution. 

Proof. We can think of as a normalized state on the symmetric subspace Sym" {Har) C Har- The dimension 
of Sym"('HAij) is bounded by fc = (n + Furthermore the normahzed states on Sym"('HA_R) can be seen 

as living in an m-dimensional real vector space where m = fc — 1 + 2 • = fc^ — 1. Now define S as the set of 

all = u!^^, where ujar = |w)(w|ar S S^{Har)- Then lies in the convex hull of the set 5' c K'^ Using 
Caratheodory's theorem (Theorem D.5 1, we have that lies in the convex hull of a set S' C S where 5" consists of 
at most p = fc^ — l + l = fc^ points. Hence we can write as a convex combination of p = {n + l)2|'4||fl|-2 extremal 
points in 5', i.e. Qr - E.^Kfi)®", where = \io'}{uj%R £ S={'Har), i € {1, 2, . . . , (n + l)2|A||fl|-2} and a 
probability distribution. □ 
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